C:\Users\Uriel\Desktop\johanna.cc\build\x64\fantaware.pdb
Static task
static1
Behavioral task
behavioral1
Sample
johanna.cc.exe
Resource
win10-20240404-en
General
-
Target
johanna.cc.exe
-
Size
411KB
-
MD5
ff9d724c24eb77fb1524e7466a99385e
-
SHA1
221f11fde1d118abeaddc2cc1d8d7aa0cb01552a
-
SHA256
f977e40738733c70791069b20c0d176818c52dfc9db3cc4d07347b7ea9c0b61b
-
SHA512
53fd82cc602c88f67d42c4ea6d31559978ccc3f5d35f02d7c17fdf50cab84348922f0b445327565d332f764eb45b901cbb883721d58401c79781c80d90c7befb
-
SSDEEP
6144:WYTmRYvCe0qgC3LA6kugXviRP+oLTRZsUWzgTtAkIon07Njj2:WYqus2gXvgHTRZsUWEuon07Nf2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource johanna.cc.exe
Files
-
johanna.cc.exe.exe windows:6 windows x64 arch:x64
c59888edf95a2a37608b11b482b495d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
ReadProcessMemory
SetConsoleTitleW
VirtualQueryEx
Process32NextW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
MultiByteToWideChar
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GlobalAlloc
K32EnumProcessModules
Module32NextW
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
GetCurrentProcessId
K32GetModuleFileNameExW
user32
SetCursor
DefWindowProcW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
TranslateMessage
LoadIconW
mouse_event
SetWindowLongW
PostQuitMessage
FindWindowA
GetKeyState
UpdateWindow
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
ScreenToClient
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
d3d9
Direct3DCreate9Ex
msvcp140
??Bid@locale@std@@QEAA_KXZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
imm32
ImmAssociateContextEx
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
memmove
memset
_CxxThrowException
memcpy
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_destroy
strstr
__std_terminate
memcmp
memchr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_exit
_get_initial_narrow_environment
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_initialize_onexit_table
_initialize_narrow_environment
_errno
_initterm
terminate
system
_beginthreadex
exit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
fflush
fclose
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
atof
api-ms-win-crt-time-l1-1-0
_difftime64
_localtime64
_time64
_mktime64
api-ms-win-crt-math-l1-1-0
cosf
atan2f
fmodf
sqrtf
powf
sinf
acosf
__setusermatherr
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 332KB - Virtual size: 331KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ